registry / @feathery/react / 2.89.1
@feathery/react@2.89.1
React library for Feathery
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe scanner findings resolve to a product API client, an audio decoder, and a pinned PDF.js dynamic import. The prepare-only Husky hook is a limited development hook and does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Using the React library's form, assistant, or PDF-viewer features.
Impact
No unconsented install-time mutation or malicious data exfiltration was found.
Mechanism
Product API requests and a pinned PDF renderer import.
AI rationale
The scanner findings resolve to a product API client, an audio decoder, and a pinned PDF.js dynamic import. The prepare-only Husky hook is a limited development hook and does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has a prepare hook that invokes Husky.
- The PDF viewer dynamically imports a pinned pdfjs module from jsDelivr.
- The bundled assistant code contains a dynamic-import helper.
- The client bundle defines Feathery-owned API endpoints for its form and integration features.
Evidence against
- There are no preinstall, install, or postinstall hooks, and no runtime dependency on this package itself.
- The dynamic import is confined to a version-pinned PDF renderer and its worker.
- The flagged base64 decoding in the assistant bundle is not paired with execution.
- No source evidence shows credential harvesting, filesystem access, shell execution, stealth persistence, or exfiltration to an unrelated host.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/fthry_pdfjsLoader.CRkrFcJY.jsView file
27// eslint-disable-next-line no-new-func
L28: var dynamicImport = new Function('u', 'return import(u)');
L29: function loadPdfjs() {
High
Eval
Package source references dynamic code evaluation.
dist/fthry_pdfjsLoader.CRkrFcJY.jsView on unpkg · L27dist/fthry_index.BAGmvRvy.jsView file
74};
L75: var createTemplate = function (code, initialValue, elementId) { return "\n<!DOCTYPE html>\n<html>\n <head>\n <script src=\"https://cdn.jsdelivr.net/npm/@babel/standalone/babel....
L76:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/fthry_index.BAGmvRvy.jsView on unpkg · L74cjs/fthry_index.B__iQ9Xl.jsView file
Findings
1 Critical5 High5 Medium4 Low
CriticalRemote Asset Decode Executeumd/AssistantChat.f564585b8f044e96f031.js
HighChild Process
HighEvaldist/fthry_pdfjsLoader.CRkrFcJY.js
HighBrowser Session Account Hijackcjs/fthry_index.B__iQ9Xl.js
HighBase64 Obscured Urlcjs/fthry_index.B__iQ9Xl.js
HighSemantic Analysis Limitedcjs/fthry_index.B__iQ9Xl.js
MediumDynamic Requiredist/fthry_index.BAGmvRvy.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/fthry_index.DWYWEDkz.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to @feathery/react@2.89.1.
See all versions of @feathery/react for other recorded verdicts.
- Review the evidence and your use of @feathery/react@2.89.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.